purlotor[.]mobile-vzw[.]vip

Analysis date July 29 2026. The domain purlotor.mobile-vzw.vip was registered on October 4 2025 through Gname.com Pte. Ltd. It currently resolves to the IPv4 address 188.114.96.3. The domain appears on a single public security blocklist and is listed as blocked by the PhishDestroy service. Google Safe Browsing classifies the site as a social engineering threat, which aligns with the generic phishing label assigned by analysts.

VirusTotal has processed the domain and 12 of 91 scanned security vendors returned a positive detection, reinforcing the suspicion of malicious activity. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or content analysis is available at this time. The limited visibility means that the exact phishing lures, targeted brands, or credential‑harvesting mechanisms remain unknown. However, the combination of blocklist presence, Safe Browsing flag, and multi‑vendor detections indicates a high‑confidence malicious infrastructure.

Defenders should add the domain to outbound and inbound filtering rules, monitor DNS queries for the address 188.114.96.3, and consider sharing the indicator with threat‑intel platforms. Continuous re‑scanning on VirusTotal and periodic checks of the blocklist status are recommended to capture any changes in detection coverage. Given the high risk rating, organizations handling sensitive credentials should treat any traffic to this domain as hostile.